REMARKS 



Claims 1-23 are pending. 

Claim 23 stands rejected under 35 U.S.C. 101 as being directed to non-statutory subject 

matter. 

The rejection is respectfully traversed. Claim 23 recites a computer program product for 
protecting a computer environment, the computer program product being embodied in a 
computer readable medium. An example of a computer readable medium may be found, without 
limitation, at p.3, 11.3-4 of the specification (". . . a computer readable medium such as a computer 
readable storage medium . . ."). Since the claimed computer program product imparts 
functionality of protecting a computer environment when employed as a computer component, it 
should be considered as "functional descriptive material" according to MPEP 2106.01. When 
functional descriptive material is recorded on some computer-readable medium, it becomes 
structurally and functionally interrelated to the medium and will be statutory in most cases since 
use of technology permits the function of the descriptive material to be realized. MPEP 2106.01 . 
A claimed computer-readable medium encoded with a computer program is a computer element 
which defines structural and functional interrelationships between the computer program and the 
rest of the computer which permit the computer program's functionality to be realized, and is 
thus statutory. MPEP 2106.01 I. As such, claim 23 is believed to be statutory and fulfilling the 
requirements of 35 U.S.C. 101. 

The Examiner has rejected claims 1-3, 9-16, 19-20, and 22-23 under 102(e) as being 
anticipated by Sameshima et al. (US 6,038,564). 

The rejection is respectfully traversed. With respect to claim 1, Sameshima teaches a 
method for collecting/distributing message data or data stored in processing devices in a 
distribution processing system (Sameshima 1 :7-9). According to Samishima, the object of the 
invention is "to provide a distributed information integrating method and apparatus which can 
arrange data requested by a request side and supply the arranged data to the request side at a 
timing requested by the request side irrespective of a location of a processing device in which the 
data are stored, and also which can make an application program at the request side independent 
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of changes of data storage medium or a transmission medium used for data collection." (2:65- 
3:6). Sameshima, however, does not teach or suggest a method for protecting a computer 
environment. 

Further, Sameshima does not teach "comparing a first event with the index". Although 
Sameshima describes a collection item table index, an output option index, and a status 
management index, the indexes are merely used to indicate specific storage places, to for 
comparing with a first event. According to Sameshima, "[t]he collection item table index 313 is 
an index for indicating a storage place of the corresponding collection item table", "[t]he output 
option index 314 is an index for indicating a storage place of the corresponding output option 
table", and "[t]he status management table index 315 is an index for indicating a storage place of 
the corresponding status management table". (6:9-18). Although Sameshima teaches a data item 
and a reference source to be collected in response to the occurrence of an event (6:22-24), the 
comparison is between the value of the data item of the data indicated by the source name and 
the value of the data item received by the event indicated by the collection event 312 (6:49-52). 
Thus, no comparison of the first event with the index is made according to Sameshima. 

Further, Sameshima does not teach "determining whether a security incident associated 
with the first event has occurred". Sameshima' s invention is concerned with collecting and 
distributing message data or data stored in a distribution processing system and is not concerned 
with protecting computer environment or detecting security incidents. Thus, Sameshima does 
not teach any security incident associated with an event. As such, claim 1 is believed to be 
allowable. 

Claims 2-21 depend from claim 1 and are believed to be allowable for the same reasons 
described above. 

Similarly, claims 22 and 23 are believed to be allowable since Sameshima does not teach 
a system for protecting a computer environment, comprising a processor configured to provide 
an index, compare a first event with the index, determine whether the first event is unusual and 
determine whether a security incident associated with the first event has occurred, or a computer 
program product for protecting a computer environment and being embodied in a computer 
readable medium and comprising computer instructions for providing an index, comparing a first 
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event with the index, determining whether the first event is unusual, and determining whether a 
security incident associated with the first event has occurred. 



Reconsideration of the application and allowance of all claims are respectfully requested 
based on the preceding remarks. If at any time the Examiner believes that an interview would be 
helpful, please contact the undersigned. 

Respectfully submitted, 

Da»ed: 




Diana Y. Fu 
Registration No. 52,924 
V 408-973-2593 
F 408-973-2595 



VAN PELT, YI & JAMES LLP 
10050 N. Foothill Blvd., Suite 200 
Cupertino, CA 95014 
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